International Operation Dismantles AudiA6 Mixer, $390M Ring

An international law enforcement operation involving 11 countries dismantled AudiA6, a crypto mixer that processed roughly €336 million ($390 million) between 2022 and 2025. Two administrators, identified as Russian and Ukrainian nationals, were arrested in Georgia on Wednesday, Eurojust announced Thursday.

Authorities seized 25 domain names, removed more than 30 servers, impounded about 80 vehicles and froze nearly $900,000 in cryptocurrency as part of the action, Eurojust reported.

The operation focused on AudiA6’s online infrastructure. Law enforcement replaced both regular web and dark web domains for AudiA6 and a related marketplace, Dark2Web, with seizure banners. Europol coordinated the takedown alongside Eurojust and national agencies from the United States, Australia, France, Poland, Georgia, Iceland, Canada, Germany, Japan, Switzerland and the United Kingdom.

AudiA6 operated as a “mixer-as-a-service.” The service offered to obscure the origin of digital currency by pooling and redistributing coins, typically completing transactions in about an hour for fees between 3% and 10%. Chainalysis data cited in the investigation showed AudiA6 wallets received about 10,333 BTC since 2021, valued at roughly $389 million at the time of those transactions.

Investigators identified thousands of fraudulent identity records used to feed the laundering operation. Eurojust reported more than 6,000 Know Your Customer (KYC) records tied to so-called money mule accounts, with many linked to Russian-speaking intermediaries recruited to move proceeds through cryptocurrency exchanges.

The Australian Federal Police contributed to the probe and reported that AudiA6 handled part of a ransom payment made by an Australian company in 2024 following a ransomware extortion.

Authorities said the network behind AudiA6 also operated Dark2Web, a forum used to advertise illicit services and connect cybercriminals. Both the visible and dark web versions of the platforms are offline and display seizure notices.

Mixers like AudiA6 are designed to break the traceable chain of transactions by pooling funds and then redistributing them in smaller amounts, a method often used to hide the source and flow of stolen cryptocurrency. Ransomware actors have used such services to cash out illicit proceeds.

The investigation remains active. Officials said the coordinated action will aid further probes into the syndicate’s global connections and into individuals who used the service to move criminal proceeds.